Iris liveness detection for mobile devices

ABSTRACT

An approach for an iris liveness detection is provided. A plurality of image pairs is acquired using one or more image sensors of a mobile device. A particular image pair is selected from the plurality of image pairs, and a hyperspectral image is generated for the particular image pair. Based on, at least in part, the hyperspectral image, a particular feature vector for the eye-iris region depicted in the particular image pair is generated, and one or more trained model feature vectors generated for facial features of a particular user of the device are retrieved. Based on, at least in part, the particular feature vector and the one or more trained model feature vectors, a distance metric is determined and compared with a threshold. If the distance metric exceeds the threshold, then a first message indicating that the plurality of image pairs fails to depict the particular user is generated. It is also determined whether at least one characteristic, of one or more characteristics determined for NIR images, changes from image-to-image by at least a second threshold. If so, then a second message is generated to indicate that the plurality of image pairs depicts the particular user of a mobile device. The second message may also indicate that an authentication of an owner to the mobile device was successful. Otherwise, a third message is generated to indicate that a presentation attack on the mobile device is in progress.

BENEFIT CLAIM

This application is a continuation of U.S. application Ser. No.16/240,120 filed Jan. 4, 2019, which is a continuation of U.S.application Ser. No. 15/340,926, filed Nov. 1, 2016, issued on Jan. 8,2019 as U.S. Pat. No. 10,176,377 which claims the benefit under 35U.S.C. § 119 of U.S. provisional application 62/249,798, filed Nov. 2,2015, the entire contents of which are hereby incorporated by referencefor all purposes as fully set forth herein.

FIELD

Embodiments described herein relate generally to an iris livenessdetection, and more specifically, to techniques for capturing and usinginformation about the iris liveness to authenticate a user to a mobiledevice.

BACKGROUND

Since the introduction of a first smartphone in 1994, there has been arapid growth in smartphones' technology. Smartphones have become muchmore than just computers; they also provide functionalities of personaldatabases, jukeboxes, cameras, communications hubs and communicationsgateways.

As today's smartphones are increasingly used to store and communicatesensitive financial and personal information, a reliable assessment ofan identity of the smartphone's user is emerging as an important newservice. Personal identification numbers or passwords appear to beinsufficient for this purpose.

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings:

FIG. 1 is an example mobile device environment for implementing an irisliveness detection according to an example embodiment;

FIG. 2 is a flow diagram depicting an example iris liveness detectionprocess according to an example embodiment;

FIG. 3 depicts examples of RGB/NIR image pairs acquired according to anexample embodiment;

FIG. 4 depicts examples of RGB/NIR image pairs acquired from a liveperson and examples of RGB/NIR image pairs acquired from photographs andcomputer displays;

FIG. 5 depicts examples of RGB/NIR image pairs acquired from a 3-D modelof a face;

FIG. 6 depicts a pupil localization process according to an exampleembodiment;

FIG. 7 depicts an example sequence of images showing an eye-blinkingeffect;

FIG. 8 is an example binary decision tree used to determine whetherimages depict a live person or are part of a presentation attack;

FIG. 9 is a flow diagram of an example process for detectingpresentation attacks according to an example embodiment;

FIG. 10 illustrates a computer system upon which one or more embodimentsmay be implemented.

DETAILED DESCRIPTION

In the following description, for the purposes of explanation, numerousspecific details are set forth in order to provide a thoroughunderstanding of the embodiments. It will be apparent, however, that theembodiments may be practiced without these specific details. In otherinstances, well-known structures and devices are shown in block diagramform in order to avoid unnecessarily obscuring embodiments.

INTRODUCTION

Techniques are described herein for detecting liveness of a human irisusing a mobile device. In an embodiment, the techniques include aworkflow for acquiring iris biometric information of a person attemptingto use a mobile device. The iris biometric information may be acquiredusing electronic sensors integrated with the device. The sensors may beconfigured to capture images of an eye or an eye's iris region. Examplesof mobile devices may include smartphones, tablets, PDAs, laptops,electronic watches, and the like.

Electronic sensors may be configured to capture image pairs. An imagepair includes a visible red-green-blue (RGB) spectrum image and a nearinfra-red (NIR) spectrum image of an eye or an eye's iris region.Capturing of the RGB and NIR images may be performed synchronously interms of timing.

An RGB/NIR hybrid sensor is an example of a sensor configured to captureRGB/NIR image pairs synchronously. The RGB/NIR hybrid sensor is anelectronic sensor configured to capture both an RGB image and an NIRimage of the same scene and at the same time. The captured RGB/NIR imagepair include the images that depict objects shown in the same spatialrelationships to each other in each of the images. Therefore, the imagesof the RGB/NIR pair depicting for example, and eye, will depict the eyeat the same location in each of the two images of the pair.

RGB and NIR images may be collectively referred to as incoming images.An incoming image may capture multi-spectral information specific tocharacteristics of a human eye and/or the eye' iris region. Themulti-spectral information may be mapped onto one or more discretefeature vectors representing the characteristics of the eye's irisregion.

Discrete feature vectors may be processed by applying one or moreclassifiers to the vectors to generate a classified image. A classifieris a means for analyzing contents of an image and contents of featurevectors generated for the image. Examples of classifiers may includeintermediate classifiers which use a distance metric to determinewhether the discrete feature vectors match predetermined trainingfeature vectors. For example, if a distance value computed based on adiscrete feature vector of an image depicting a person attempting to usea mobile device and a training feature of an image depicting an actualowner of the mobile device exceed a certain threshold, then it may beconcluded that the person attempting to use the device is not thedevice's owner.

Classified images of an eye and/or an iris region may be furtherprocessed using multi-frame pupil localization techniques. Pupillocalization techniques may include processing of pupil regionsidentified in the classified images and determining one or morecharacteristics of the pupil. The characteristics of the pupil may beused to determine liveness of the depicted iris. For example, thecharacteristics may be used to determine whether the images depict aniris of an owner of a mobile device or an iris of an imposter attemptingto use the mobile device.

In an embodiment, the techniques described herein allow detectingspoofing attacks and security breaches committed with respect to mobiledevices. The techniques are applicable to implementations involvingactual human faces as well as 3-D face models made of materials thathave properties similar to properties of human faces.

OVERVIEW

In an embodiment, a method comprises acquiring a plurality of imagepairs using one or more image sensors. The sensors may be integratedwith a mobile device, and the image pairs may depict a person whoattempts to use the mobile device. Each image pair, of the plurality ofimage pairs, may include an RGB image and a NIR image, both imagesacquired in a synchronized manner. Acquiring a pair of images in thesynchronized manner may include acquiring the images of the pair at asame time. The sensors may include at least one hybrid RGB/NIR sensor.

A particular image pair that depicts an eye-iris region in-focus isselected from a plurality of image pairs. Based on, at least in part,the particular image pair, a hyperspectral image is generated. Thehyperspectral image may be generated by fusing two images included inthe particular image pair.

Based on, at least in part, a hyperspectral image, a particular featurevector for the eye-iris region depicted in the particular image pair isgenerated. The particular feature vector may numerically represent aparticular feature, such as an iris region depicted in the image pair.

One or more trained model feature vectors are retrieved from a storageunit. The trained model feature vectors may be generated based on imagesdepicting an owner of a mobile device. The images depicting theparticular user depict valid biometric characteristics of the owner ofthe device. The trained model features vectors are used to determinewhether the particular feature vector have some similarities with theparticular feature vector generated from image pairs depicting a personattempting to use the mobile device. The similarities may be quantifiedusing a distance metric computed based on the particular feature vectorand the one or more trained model feature vectors.

A distance metric represents a similarity measure between the trainedmodel feature vectors and a particular feature vector. Statingdifferently, a distance metric represents a similarity measure of theparticular image pair, acquired from a person attempting to use a mobiledevice, and the trained model feature vectors generated based on thevalid biometric characteristics of an owner of the mobile device.

A distance metric may be compared with a predefined first threshold. Thefirst threshold may be determined empirically. If the distance metricexceeds the first threshold, then a first message indicating that theplurality of image pairs fails to depict the particular user of a mobiledevice is generated. The first message may also indicate that the personwhose depictions were acquired by the sensors of the mobile device isnot the owner of the mobile device. Furthermore, the first message mayindicate that a presentation attack on the mobile device is in progress.

However, if the distance metric does not exceed the first threshold,then two or more image pairs that depict an iris are selected from theacquired plurality of image pairs. For each NIR image of each imagepair, of the two or more image pairs, one or more characteristics of theiris depicted in the image pair are determined.

It is also determined whether at least one characteristic, of the one ormore characteristics determined for NIR images, changes fromimage-to-image by at least a second threshold. If so, then a secondmessage indicating that the plurality of image pairs depicts theparticular user of a mobile device is generated. The second message mayalso indicate that the person whose depictions were acquired by thesensors of the mobile device is the owner of the mobile device.Furthermore, the second message may indicate that an authentication ofthe owner to the mobile device was successful. Otherwise, a thirdmessage may be generated to indicate that a presentation attack on themobile device is in progress.

Supervised and Unsupervised Authentications

Biometric information has been traditionally used by law enforcement tosecure and restrict access to resources and facilities, and to establishidentities of individuals. Biometric technology has been employed at forexample, airports, train-stations, and other public areas. In thesesituations, biometric information is acquired in so called supervisedsettings. In a supervised setting, one individual oversees anacquisition of biometric information from another individual to ensurevalidity of the acquired information. Because the acquisition of thebiometric information in these settings is supervised, spoofing of thebiometric information of the individual is rather rare.

However, when biometric technology is adapted in unsupervised settings,spoofing of biometric information of an individual is not uncommon. Forexample, when biometric information is used to authenticate anindividual to a consumer device such as a mobile device, a biometricdata acquisition process is usually unsupervised. Thus acquiringbiometric information of an individual in an unsupervised setting may beprone to spoofing. For instance, a fingerprint authentication, which hasbeen widely adopted in mobile devices, may be easily targeted by variousspoofing techniques.

Arguably, a human supervision may be an effective way for detectingspoofing attacks and widely used in many applications including bordersecurity patrol. However, the supervision is impractical in cases ofmobile devices and other consumer electronic devices.

Iris Biometrics

An iris of an eye is an annular region between a pupil and a sclera ofthe eye. An iris region usually has a distinct pattern, and due to itsdistinctiveness, the pattern may be used to uniquely identify a person.Typically, an iris pattern contains complex and distinctive ligaments,furrows, ridges, rings, coronas, freckles and collarets. An iris patternbecomes relatively stable at the eight month of gestation, and remainsstable throughout the person's lifetime.

Iris patterns usually demonstrate high variability. For example, eventwin children may have different iris patterns. In fact, an iris patternof the left eye of a person is most likely different than an irispattern of the right eye of the same person. The unique characteristicsof an iris region make the iris a suitable source of biometricinformation useful to authenticate individuals.

In an embodiment, biometric characteristics of an iris are collected andanalyzed using mobile devices such as smartphones, tablets, PDAs,laptops, watches, and the like. The process of collecting and analyzingthe biometric characteristics may be implemented to authenticate a userto a mobile device, to detect spoofing attempts, and/or to detectliveness of the iris in general.

Unsupervised Authentication to Mobile Devices

Authentication of a person to a mobile device based on the person's irisbiometrics is usually unsupervised. It is unsupervised because it doesnot require any monitoring of the person authenticating himself to thedevice. Indeed, usually only the person who authenticates himself to thedevice participates in the authentication process.

Unsupervised authentication approaches based on biometric data are moresusceptible to spoofing than traditional authentication techniques. Thisis because in the unsupervised authentication no one is monitoring auser as the user's biometric data is acquired. Since there is nomonitoring, an imposter may attempt to provide intercepted or falseinformation to gain access to a mobile device of another person.

Spoofing attacks on an unsupervised authentication system may includepresenting to a mobile device biometric data of a person other than auser of the device, and mimicking real biometric information of the userof the device to gain access to the user's device. The mimicking mayinclude providing to the device an iris biometric sample that wasrecorded without co-operation or knowledge of the user. This may includepresenting, by an imposter, a picture, a recorded video, or a highquality iris image of the user in front of the device to gain access theuser's device. These types of attacks are collectively referred to aspresentation attacks.

Iris Liveness Detection Approach

An iris liveness detection approach presented herein is an anti-spoofingtechnique. The iris liveness detection allows determining whetherbiometric information presented to a device is an actual biometricmeasurement obtained from a live person and whether it was captured atthe time when the biometric information is presented to the device.

An automatic liveness detection approach may include an analysis ofintrinsic properties of a live person, an analysis of involuntary bodysignals, and a challenge-response analysis. In the context of an irisliveness detection, the analysis of intrinsic properties may includeanalyzing spectrographic properties of a human eye, analyzing a red-eyeeffect, and analyzing a 3-D curvature of an iris surface. An analysis ofinvoluntary body signals may include analyzing an eyelid movements andhippus. A challenge-response analysis may include analyzing a user'sresponse when the user is prompted to blink or look at differentdirections.

In an embodiment, an automatic iris liveness detection approach isimplemented as part of an iris recognition system, and is used as acountermeasure against spoofing. It may be implemented in hardware,software, or both. It is applicable to a variety of electronic devicesand its implementation may be optimized to minimally affect performanceof the iris recognition system built into the devices.

Iris Liveness Detection Implemented in Mobile Devices

Iris liveness detection techniques may be implemented in mobile devices.The techniques allow recognizing static images such as high qualityprinted images of an iris, iris images projected on a screen, or highresolution video frames, and determining whether such images arepresentation attacks on mobile devices. The techniques may beimplemented in a variety of mobile devices without requiring any specialhardware. Therefore, the techniques may be inexpensive solutions againstpresentation attacks. Furthermore, the techniques may not depend on userinteractions, and thus they may be widely adopted for every day-use byconsumers. Moreover, iris liveness detection techniques may becost-effective yet powerful mechanisms incorporated into mobile devices.Implementations of the techniques may be computationally light, and maybe embedded in a camera pipeline of the mobile device on in digitalsignal processors dedicated to an iris recognition.

In an embodiment, an iris liveness detection technique includesacquiring and processing visible spectrum RGB images as well as NIRimages by a mobile device. The images may be captured using cameras orsensors integrated in the device. If a mobile device is equipped withcameras, then at least one camera may be a hybrid front facing cameraconfigured to perform an iris recognition, and at least one camera maybe configured to carry out video calls or selfie imaging. If a mobiledevice is equipped with RGB/NIR hybrid sensors, then the sensors may beconfigured to synchronously capture RGB/NIR image pairs.

Captured RGB/NIR image pairs may be processed using components of amobile device configured to perform a visible spectrum iris recognitionand an NIR iris recognition.

FIG. 1 is an example mobile device environment for implementing an irisliveness detection according to an example embodiment. A mobile deviceenvironment 100 may include various mobile devices. Non-limitingexamples of mobile devices include various types and models ofsmartphones 104 a-104 b, laptops 106 a-106 b, PDAs 108 a, and tablets108 b. Each mobile device may be configured to capture visual spectrumRGB images 102 a and NIR images 102 b of a person facing the device. Forthe clarity of the description, the examples described in the followingsection refer to the approaches implemented in smartphone 104 a;however, the approaches may be implemented on any type of mobile device.

In an embodiment, visual spectrum RGB images 102 a and NIR images 102 bof a person facing smartphone 104 a are captured by cameras and/orsensors integrated in smartphone 104 a. The RGB images 102 a and NIRimages 102 b may be further processed by components of smartphone 104 a.The processing may include determining liveness of an iris depicted inthe captured images. If the iris liveness is detected in the images,then the person facing smartphone 104 a may be granted access tosmartphone 104 a and resources of smartphone 104 a. However, if the irisliveness is not detected in the images, then the person facingsmartphone 104 a is denied access to the smartphone 104 a and itsresources.

Processing of RGB and NIR images by a mobile device may includedetermining locations of an iris in the images, determining locations ofa pupil within the iris in the respective images, and analyzing thedetermined locations for the purpose of detecting the iris' liveness.Detecting the iris' liveness may allow identifying incidents ofpresentation attacks on the mobile device. For example, the techniquemay allow identifying presentation attacks when mannequins, havingengineered artificial eyes used to duplicate the optical behavior ofhuman eyes, are used to gain access to mobile devices.

Iris Liveness Detection Process

In an embodiment, an iris liveness detection process is part of anauthentication process performed to authenticate a user to a mobiledevice. The iris liveness detection process may comprise two stages. Thefirst stage of the process may include acquiring a plurality of RGB andNIR image pairs depicting the user facing the mobile device, andselecting a particular RGB/NIR image pair that depicts the user's eyesin-focus. The second stage of the process may include processing theparticular image pair to detect liveness of the iris depicted in theimage pair, and determining whether the user may access the mobiledevice and its resources.

Acquiring RGB and NIR Image Pairs

FIG. 2 is a flow diagram depicting an example iris liveness detectionprocess according to an example embodiment. The example iris livenessdetection process comprises a first stage 202 and a second stage 212.

In step 204 of stage 202, an image stream is acquired by a mobiledevice. The image stream may include RGB and NIR image pairs and depicta user facing a mobile device. The pairs may be acquired using one ormore camera and/or one or more sensors integrated in the mobile device.The cameras and the sensors may be separate devices, hybrid devices, orboth, and may be configured to capture and acquire the images in asynchronized manner.

Capturing images in a synchronized manner may include synchronizing thecapturing in terms of timing. For example, a hybrid RGB/NIR sensor maybe used to capture both an RGB image and a NIR image at the same time.Synchronizing the capturing of both images allows capturing the imagesin such a way that the images depict objects shown in the same spatialrelationships to each other in each of the images.

Capturing of the images may be initiated by a user as the user tries touse a mobile device. For example, the user may press a certain key, ortouch a certain icon displayed on the device to “wake up” the device. Amobile device may be equipped with a “wake up” key, or a “unlock” key,used to request access to the mobile device and to initiate the imageacquisition process. Selection of the keys configured to initiate theimage acquisition and a naming convention for the keys depends on thespecific implementation and the type of the mobile device.

In an embodiment, a user facing a mobile device presses a “wake up” keyof the mobile device to initiate an image acquisition process. Upondetecting that the key was pressed, the mobile device initiates anRGB/NIR hybrid sensor, or cameras and sensors, integrated in the device,causes the hybrid sensor to synchronously acquire RGB and NIR images ofeyes of the user. The RGB/NIR image pairs are acquired synchronously toensure that the locations of certain features in one image correspond tothe location of the certain features in another image.

RGB and NIR image pairs may be acquired in a normal office situationwith active illumination of 1350 nm. Examples for the image pairsacquired at different stand-off distance are shown in FIG. 3.

FIG. 3 depicts examples of RGB/NIR image pairs acquired according to anexample embodiment. The examples depicted in FIG. 3 include an RGB image302 a, an NIR image 302 b, an RGB image 304 a, and an NIR image 304 b.Images 302 a-302 b depict one person and images 304 a-304 b depictanother person. The RGB/NIR image pairs may be synchronously acquired byan RGB/NIR hybrid sensor at the time when a user is trying toauthenticate himself to a mobile device. The image pairs may be comparedto training RGB/NIR images acquired from an owner of the device.

In step 206, an obtained image stream of RGB/NIR image pairs isprocessed to select an RGB/NIR image pair that depicts an eye-irisregion in-focus. This may include applying detectors configured todetect eye-iris regions in the image pairs and select a subset of theimage pairs that depict the eye-iris regions, and comparators configuredto select, from the subset, an RGB/NIR image pair that depicts theeye-iris region in focus. If the eyes are detected in one image pair,the eyes' locations in the subsequently captured image pairs may betracked until one or more image pairs depicting the eyes in-focus arefound. For example, the visible spectrum (wavelength) of the imagestream may be subjected to a certain type of processing to determineimages that depict a sequence of good quality, in-focus eye regions. Theprocessing may be performed using the state-of-the art face detectors,eye location detectors, and eye trackers.

Generating a Hyperspectral Image from RGB/NIR Image Pairs

In step 208, based on an RGB-NIR image pair depicting an eye-regionin-focus, a hyperspectral image is generated. A hyperspectral image isgenerated from an RGB image and a NIR image of the image pair by fusingboth images into one image. Fusing of an RGB image and a NIR image maybe accomplished by applying a fusing operator to a mathematicalrepresentation of the RGB image and a mathematical representation of theNIR image.

In an embodiment, a mathematical representation I_(v) of an RGB imageand a mathematical representation I_(i) of a NIR image of an RGB/NIRimage pair are obtained and used to generate a hyperspectral imageI_(h). The mathematical representations of the RGB image and the NIRimage capture ambient light and a surface reflectance on an eyerepresented at four different wavebands (Blue, Green, Red and NIR),respectively. The hyperspectral image I_(h), obtained by fusing themathematical representations of the RGB and NIR images, will capture anambient light and a surface reflectance on an eye represented at thefour different wavebands and derived by applying a fusing operator tothe respective mathematical representations.

In an embodiment, mathematical representations of an RGB image and anNIR image of an image pair are generated. The RGB and NIR imageformation by an RGB/NIR hybrid sensor may be captured using thefollowing expression:

$\begin{matrix}{I_{v} = {\int\limits_{\lambda_{v}}{\int\limits_{p}{{E\left( {p,\lambda_{v}} \right)}{R(p)}{Q\left( \lambda_{v} \right)}{dpd}\lambda_{v}}}}} & (1)\end{matrix}$ $\begin{matrix}{I_{i} = {\int\limits_{\lambda_{1}}{\int\limits_{p}{{E\left( {p,\lambda_{i}} \right)}{R(p)}{Q\left( \lambda_{i} \right)}{dpd}\lambda_{i}}}}} & (2)\end{matrix}$

where I_(v)∈^(˜m×n) is the RGB image, I_(i)∈^(˜k×I) is the NIR image,

λ_(v)∈[350 nm, 700 nm], λ_(i)∈[750 nm, 900 nm] are the wavelength rangesof the RGB and NIR images, respectively;

where p is the spatial domain of the sensor;

where R is the spatial response of the sensor,

where E is the irradiance; and

where Q is the quantum efficiency of the sensor.

In an embodiment, I_(i)∈^(˜k×I) is demosaiced/interpolated to obtainm=k, n=l. That means that I_(i) (the mathematical representation of theNIR image) is demosaiced/interpolated so that the mathematicalrepresentation of the NIR image has the same size m×n as themathematical representation of the RGB image.

The two images, I_(v) and I_(i) are fused together to generate ahyperspectral image I_(h) using the following expression:

I _(h)=Γ(I _(v) ,I _(i))  (3)

where I_(h)∈^(˜m×n×4) and Γ is a fusing operator.

In an embodiment, a hyperspectral image I_(h) is further processed tominimize the effect of ambient light. This may be accomplished byobtaining metadata from a camera or a sensor, and using the metadata toperform a white color balance, a gamma correction, and/or an autoexposure correction of the hyperspectral image I_(h).

Generating Feature Vectors from a Hyperspectral Image

In an embodiment, an iris liveness detection process includes a secondstage. In the second stage, a hyperspectral image I_(h) is processed toidentify one or more multispectral features depicted in thehyperspectral image. Since the hyperspectral image I_(h) represents anambient light and a surface reflectance on an eye represented at fourdifferent wavebands (Blue, Green, Red and NIR), image data in each ofthe wavebands of the hyperspectral image I_(h) may be processedindividually to extract the features from each waveband separately.

Extracting features from a hyperspectral image may include clusteringimage data of the hyperspectral image based on the intensity valueswithin each of the wavebands and determining the features based on theclustered image data. Extracted features may be represented as featuresvectors.

A feature vector generated for an image is a vector that containsinformation describing one or more characteristics of an object depictedin the image. An example feature vector may include a numerical valuerepresenting characteristics of an eye region depicted in the image. Thenumerical value may be computed based on raw intensity values of thepixels that constitute the eye region.

Referring again to FIG. 2, in step 214 of second stage 212, one or morefeature vectors are generated based on a hyperspectral image obtained infirst stage 202.

In an embodiment, a hyperspectral image I_(h) is viewed as comprisingfour image planes (I_(c1), I_(c2), I_(c3), I_(c4)) having the size m×nand representing four different wavebands. The planes may also bereferred to as channels. The pixels in each plane are clusteredseparately to form α predefined clusters. The clustering process may berepresented using the following expression:

I _(cj) ^(u)=Ω(I _(cj)),  (4)

where I_(cj) ^(u)∈[1,α]^(m×n) represents a label of the clustercorresponding to the pixels in I_(cj), j∈[1,4] denotes the image channel(waveband), α is a count of the clusters, and Ω is the clusteringoperator. While the count a of clusters may be chosen in any manner, inan embodiment, based on the dimensionality and computational complexityof expression (4), α=8 is chosen.

In an embodiment, a clustering operator Ω is a nearest neighborhoodclustering operator configured to group the pixels in each plane intoone of the a cluster at the time and based on the intensity values ofthe pixels in the plane.

In an embodiment, the label clusters are concatenated to obtain:

I _(h) ^(u)=Γ′(I _(c1) ^(u) ,I _(c2) ^(u) ,I _(c3) ^(u) ,I _(c4)^(u)),  (5)

where Γ′ is a concatenation operator.

Due to different combinations of clustering obtained by theconcatenation of the label clusters for four channels, each element inI_(h) ^(u) may have one of the s=α⁴ unique combinations. The normalizedfrequency distribution of each combination may be calculated using atransform operator H:

H:→I _(h) ^(u) =F,  (6)

where F=(f₁, f₂, . . . , f_(s)) is the number of times each uniquecluster combination appeared in I_(h) ^(u). The mapping defined usingexpression (6) may be used as feature vectors determined for thehyperspectral image I_(v).

The feature extraction technique presented herein represents a uniquedistribution of information across various image planes in ahyperspectral image L. Furthermore, the presented technique iscomputationally inexpensive and generates relatively compact featurevectors.

Obtaining Trained Model Feature Vectors

In step 216 of stage 212, one or more trained model feature vectors areobtained or retrieved. The trained model feature vectors may begenerated based on actual and reliable images of a “live” user of amobile device, and stored in storage units of the device.

Trained model feature vectors for a live user may be calculated when theuser's mobile device is configured to implement an iris livenessdetection approach. The vectors may be generated based on one or moreimages depicting for example, facial features of the user, and may beused to train an image classifier to predict whether other images mostlikely depict the user of the mobile device or whether the other imagesare presentation attacks on the device.

Determining a Distance Metric

In step 218, a distance metric (DM) is computed based on a featurevector, generated from a hyperspectral image, and one or more trainedmodel feature vectors retrieved from a storage unit. A storage unit maybe a volatile memory unit of a mobile device, a non-volatile memory unitof the mobile device, or any other unit configured to store data.

A distance metric is a numerical representation of similarities betweena feature vector generated from a hyperspectral image and trained modelfeature vectors generated from images of a user of a mobile device. If adistance value computed from the feature vector and the trained modelfeature vector exceeds a certain threshold, then the feature representedby the feature vector is dissimilar to the feature represented by thetrained model feature vector. This may indicate that an individual whosedepictions were used to generate the hyperspectral image is an imposter,and not the user of the mobile device.

However, if the distance value does not exceed the certain threshold,then the feature represented by the feature vector is similar, or maybeeven identical, to the feature represented by the trained model featurevector. This may indicate that the individual whose depictions were usedto generate the hyperspectral image is the user of the mobile device.

In an embodiment, a distance metric is computed as a deviation (error)d. The deviation d may be computed using a Bayesian approach. Assumethat F^(q) denotes a feature vector of a query image, such as ahyperspectral image generated from an RGB-NIR image pair acquired by anRGB-NIR hybrid sensor. Furthermore, assume that F^(db) denotes one ormore trained model feature vectors of a trained model. The trained modelmay be trained on actual images of a user of a mobile device. In aBayesian approach, a deviation d is measured as the square root of theentropy approximation to the logarithm of evidence ratio when testingwhether the query image can be represented as the same underlyingdistribution of the live images. This can be mathematically representedas:

$\begin{matrix}{d^{q,{db}} = \sqrt{{D\left( {F^{q}{{\frac{1}{2}\left( {F^{q} + F^{db}} \right)}}} \right)} + {D\left( {F^{db}{{\frac{1}{2}\left( {F^{q} + F^{db}} \right)}}} \right)}}} & (7)\end{matrix}$ $\begin{matrix}{d^{q,{db}} = \sqrt{\sum\limits_{z = 1}^{s}\left( {{f_{z}^{q}\log\frac{2f_{z}^{q}}{f_{z}^{q} + f_{z}^{db}}} + {f_{z}^{db}\log\frac{2f_{z}^{db}}{f_{z}^{q} + f_{z}^{db}}}} \right)}} & (8)\end{matrix}$

where, D(F^(q)∥F^(db)) is the Kullback-Leibler divergence of F^(db)obtained from F^(q), which is a measure of information lost when thedatabase feature vector F^(db) is approximated from the query featurevector F^(q). The above presented choice of distance metric d^(q,db) isbased on the observations that it is a close relative to Jenson—Shannondivergence and an asymptotic approximation of χ² distance. Furthermore,d^(q,db) is symmetric and fulfills the triangle inequality.

Detecting Iris Liveness Based on a Distance Metric

In step 220 of stage 212, a distance metric d^(q,db) computed usingexpressions (7)-(8) is used to determine whether an incoming query imagedepicts a live person. If d^(q,db)<β, where β∈^(˜) is a predeterminedcertain threshold, then, in step 222, it is determined that the queryimage depicts a live person. Otherwise, in step 224, it is determinedthat the query image does not depict a live person.

Presentation Attacks

Presentation attacks may include various types of spoofing attacks on amobile device. They may include mimicking real biometric information ofa user of a mobile device to gain access to the user's device. Themimicking may include for example, providing to the device an irisbiometric sample that was recorded without knowledge of the user of thedevice. One of the most common presentation attacks include presenting ahigh quality printed photograph in front of the device. For example, animposter may try to use the high quality color photograph of the user ofthe mobile device to try to access the device.

Effectiveness of approaches for detecting presentation attacks may bemeasured using various approaches. One approach includes determining aNormal Presentation Classification Error Rate (NPCER). The NPCER isdefined as the proportion of live users incorrectly classified as apresentation attack. Another approach includes determining an “AttackPresentation Classification Error Rate” (APCER). The APCER is defined asthe proportion of presentation attack attempts incorrectly classified aslive users. Yet other approach includes determining an “AverageClassification Error Rate” (ACER), which is computed as the mean valueof the NPCER and the APCER error rates.

The ability to detect presentation attacks depends on a variety offactors. For example, detecting the presentation attacks may depend onthe surface reflection and refraction of the material that is presentedin front of a hybrid sensor of a mobile device. There are manydifferences between reflection and refraction factors determined for aprinted image and reflection and refraction factors determined for ahuman skin.

In an embodiment, an iris liveness detection process detectspresentation attacks conducted using photographs shown on eitherreflective paper or a matte paper, and presentation attacks conducted byprojecting images on a screen or a display device. The approach takesadvantage of the fact that the photographic material (reflective paperor matte paper) and the displays of devices have properties that aresignificantly different than the properties of the human skin or thehuman eye.

FIG. 4 depicts examples of RGB/NIR image pairs acquired from a liveperson and examples of RGB/NIR image pairs acquired from photographs andcomputer displays. Images 402 a, 404 a, 406 a, 408 a and 409 a arevisible spectrum RGB images. Images 402 b, 404 b, 406 b, 408 b and 409 bare NIR images. Images 402 a and 402 b are images acquired from a liveperson; all remaining images depicted in FIG. 4 are examples ofpresentation attacks. Specifically, images 404 a and 404 b are highquality visible printed images. Images 406 a and 406 b are high qualityglossy NIR printed images. Images 408 a and 408 b are NIR images printedon a matte paper. Images 409 a and 409 b are NIR images shown in alaptop screen having a high resolution display. Each of pairs 404-409may be compared with image pair 402 to show the differences in surfacereflections depicted in pairs 404-409 provided during presentationattacks and surface reflections depicted in pair 402 obtained from alive person.

Advanced Presentation Attacks

However, in some cases, relying on differences in the respectiveproperties alone may be insufficient to differentiate presentationattacks from legitimate access attempts. As the spoofing techniques areevolving, presentation attacks may include techniques that go beyondusing known printing materials and image displaying devices. Newmaterials and display devices may be used to conduct presentationattacks in the future. For example, a new presentation attack may beconducted using a realistic 3-D face model of a user of a mobile device.

FIG. 5 depicts examples of RGB/NIR image pairs acquired from a 3-D modelof a face. A 3-D face model may be a mannequin that has engineeredartificial eyes with iris regions to duplicate the optical behavior ofhuman eyes, including a red-eye effect. The mannequin may be made out ofa skin-like material that has properties similar to the properties of ahuman skin. The mannequin may also have realistically reproduced hair,eyebrows, lashes, and so forth.

In FIG. 5, images 502 a, 504 a, and 506 a are visible spectrum RGBimages, while images 502 b, 504 b, and 506 b are NIR images. Images 502a and 502 b in the first row in FIG. 5 depict a realistic 3-D facemodel. Images 504 a and 504 b in the second row in FIG. 5 depict closeup images showing the human like skin, hair and ocular properties.Images 506 a and 506 b in the third row in FIG. 5 are side views of themannequin.

It appears that reflectance and refraction properties in the images of amannequin in FIG. 5 more-less correspond to reflectance and refractionproperties of photographs of a live person, such as pair 402 a-402 b inFIG. 4. For example, it appears that the eye regions in images 504 a and504 b capture a red-eye effect. Hence, the mannequin may easily bemisclassified as a live person.

Furthermore, a mannequin may be equipped with printed contact lenseswith an iris pattern of a live person. If an imposter uses images ofsuch a mannequin to conduct a presentation attack on a mobile device,then there is a possibility that the imposter may obtain an access tothe mobile device. Therefore, analyzing the spectral response of thepresented images alone may be insufficient to identify sophisticatedpresentation attacks.

Pupil Detection and Analysis

In an embodiment, an iris liveness detection approach for mobile devicesis enhanced using techniques for a pupil analysis performed on theacquired images. An analysis of a pupil of a human eye depicted in theimages increases the chances that even sophisticated presentationattacks on a mobile device may be identified. This is because mimickingboth the pupil dynamics and properties of the human eye region isunlikely feasible at the current state of image-based technologies.

Current smartphones have capabilities to acquire 120-240 frames persecond, but that capability will most likely be doubled with thenext-generation technology. For example, very soon it might be possibleto acquire as many as 30-40 images within the time window that is nowrequired to acquire only two images. If it is assumed that on average 30frames are acquired within a particular time window, then about 60images may be acquired within that time window in the future. The 60images may include 30 RGB images and 30 NIR images acquired in asynchronous manner. Therefore, the advances in the smartphone technologymay enable the smartphones to also perform a complex analysis of pupilsdepicted in the acquired images.

In an embodiment, a pupil detection and a pupil analysis are performedon a sequence of NIR images. Detecting a pupil in the NIR images mayinclude cropping the images so that the images represent only the eyeregions, and then processing the cropped images using anedge-localization approach and a gradient-based approach to determine alocation of the pupil in the images.

One-Dimensional Image Processing for a Pupil Localization

Characteristics of an iris region of the eye depicted in digital imagesmay be impacted by illumination variations and shadows created byeyelashes surrounding the eye. The issue, however, may be addressed byrepresenting the images using a representation that is less sensitive tothe illumination variations. An example of such a representation is arepresentation generated using one-dimensional image processing.

In an embodiment, characteristics of an iris region and a pupil in theiris region are captured using one-dimensional image processing.One-dimensional image processing usually requires no thresholding, andtherefore allows reducing the effect of edge smearing.

One-dimensional processing of an image may include applying a smoothingoperator along a first direction of the image, and applying a derivativeoperator along a second (the orthogonal) direction. Let I∈^(˜m×n) be acropped image depicting an eye region. Let the cropped eye image be anNIR image denoted as I_(i). The smoothed eye image may be representedusing the following expression:

$\begin{matrix}{{I_{\theta}^{s} = {{I\left( {x,\frac{r + {x{\sin(\theta)}}}{\cos(\theta)}} \right)} \otimes {S_{\theta}(x)}}},} & (9)\end{matrix}$

where I_(θ) ^(s)∈^(˜m×n) is the smoothed iris image, S_(θ)(x)∈^(˜m×1) isthe one dimensional smoothing function along a line which has aperpendicular distance of r∈• from the origin and makes an angle θ∈•with the X-axis, and ⊗ is the one-dimensional convolution operator. Theconvolution operation may be carried out for each value of r to obtainthe smoothed image I_(θ) ^(s). The smoothing function used here may bedefined using the following expression:

$\begin{matrix}{{S_{\theta}(x)} = {\frac{1}{\sqrt{2{\pi\sigma}_{s}^{2}}}{e^{\frac{{- x^{2}}{\sec^{2}(\theta)}}{2\sigma_{s}^{2}}}.}}} & (10)\end{matrix}$

where σ_(s)∈^(˜) is the standard deviation of the Gaussian function usedin the smoothing process. The one dimensional derivative operator alongthe orthogonal direction θ+90° is applied to the smoothed image fordifferent values of r to obtain an intermediate edge gradient image,expressed as:

$\begin{matrix}{{I_{\theta}^{g} = {{I_{\theta}^{s}\left( {x,\frac{r + {x{\sin\left( {\theta + {90}} \right)}}}{\cos\left( {\theta + {90}} \right)}} \right)} \otimes {G_{\theta + {90}}(x)}}},} & (11)\end{matrix}$

where

$\begin{matrix}{{G_{\theta}(x)} = {\frac{x{\sec^{2}(\theta)}}{\sqrt{2\pi\sigma_{g}^{6}}}{e^{\frac{{- x^{2}}{\sec^{2}(\theta)}}{2\sigma_{g}^{2}}}.}}} & (12)\end{matrix}$

where, σ_(g)∈^(˜) is the standard deviation of the derivative operator.The magnitude representation of an edge gradient may be obtained usingthe following expression:

I _(θ) ^(M)=√{square root over ((I _(θ) ^(g))²+(I _(θ+90)^(g))²)}.  (13)

In an embodiment, a transform operator T is applied on I_(θ) ^(M), asshown below:

I _(d) =T _(δ) I _(θ) ^(M),  (14)

where I_(d) is the transformed image. The transformation operator T ischosen in such a way that it expresses the image I_(θ) ^(M) in a binaryform, followed by the detection of the largest connected region in theimage;

where δ∈• is a threshold selected in such a way that n_(min)^(p)≤δ≤n_(max) ^(p), where n_(min) ^(p) and n_(max) ^(p) are the minimumand maximum numbers of pixels which could possibly be in the pupilregion in the particular frame. Based on metadata obtained from a faceand eye tracking system and based on the camera parameters, anapproximate number of pixels in the pupil region may be determined. Thevalue of δ may be learned for each individual frame.

FIG. 6 depicts a pupil localization process according to an exampleembodiment. In FIG. 6, image 602 depicts an original NIR image I_(i).Image 604 is an edge gradient image generated along one direction of theoriginal NIR image. Image 606 is an edge gradient image generated alongan orthogonal direction. Image 608 is a magnitude image. Image 609depicts the localized pupil.

Images 602-609 depicted in FIG. 6 may be obtained using expressions(9)-(14), and assuming that θ=90°. Image 602 represents the originalimage. Images 604-606 represent the output of one-dimensional imageprocessing for the angular direction θ and its orthogonal value. Image608 is the magnitude image obtained from the result of the onedimensional image processing, and the localized pupil is shown in image609.

Dynamic Characteristics of a Pupil

In an embodiment, after a pupil is localized in images depicting a humaneye, the images are further processed to determine dynamiccharacteristics of the depicted pupil. Dynamic characteristics of apupil may include the eye's saccades, hippus, and pupildilation/constriction which may arise naturally as the person movestoward the camera. The dynamic characteristics may also include aneye-blinking, which alters the size of a pupil area. Examples of imagesthat were captured as a person was blinking are depicted in FIG. 7.

FIG. 7 depicts an example sequence of images showing an eye-blinkingeffect. Images 702, 704, 706 and 708 are NIR images depicting an eye ofa live person and acquired as the person was blinking. Images 712, 714,716 and 718 are black-and-white images depicting locations and sizes ofthe pupils identified in the images 702, 704, 706, and 708,respectively. Images 712, 714, 716 and 718 show that the sizes of thepupil and the pupil's locations were changing as the person wasblinking. The changes appear to be significant in detecting the irisliveness, and may be measured with an acceptable accuracy using thepresented pupil analysis technique.

Pupil Analysis

A pupil analysis may include an analysis of a pupil area in general, andan analysis of a pixel intensity in the pupil region in particular. Forexample, a pupil analysis performed on the images may involvedetermining whether a size of the pupil area depicted in the images ischanging from image-to-image, or whether an eye-blinking is depicted inthe images. If such changes are detected in the images, then it may beconcluded that the images depict a live person. However, if such changescannot be detected, then the images are most likely provided as apresentation attack. For example, the images may be images taken from amannequin whose eyes have no dynamic characteristics, such as aneye-blinking.

In an embodiment, a pixel intensity in a pupil region of any of NIRimages 712, 714, 716, and 718 of FIG. 7 is determined using a Purkinjeimage. A Purkinje image is an image formed by the light reflected fromthe four optical surfaces of the human eye. Purkinje images may be usedin various applications, including an iris liveness detection, an eyetracking, and a red-eye effect detection.

Binary Decision Tree

In an embodiment, a binary decision tree is used to classify a sequenceof images captured by a mobile device and depicting human eyes. Thebinary decision tree may be used to classify the images as either imagesof a live person or images presented as part of a presentation attack.

A binary decision tree may be designed to interface with differentmodels and approaches, including an intermediate decision approach ofFIG. 2 for an iris liveness detection, and a pupil analysis described inFIG. 6 and FIG. 7. The binary decision tree usually has one root nodeand one or more intermediate nodes. An example of the binary decisiontree is depicted in FIG. 8.

FIG. 8 is an example binary decision tree used to determine whetherimages depict a live person or are part of a presentation attack. Anexample binary decision tree 800 comprises a root node 802, anintermediary decision node 804, and result nodes 806, 808 and 810. Rootnode 802 is used to determine whether an incoming image depicts a liveiris or a presentation attack image. This may be determined based on adistance metric d^(q,db) computed using expressions (7)-(8) describedabove, and where q represents an incoming image (a query image) and dbrepresents a feature vector F^(db) described above.

In root node 802, a decision is made whether d^(q,db)<β, where β∈^(˜)and corresponds to a predetermined threshold value. If d^(q,db)<β, thenit may be concluded that the incoming image depicts a live person, andfurther processing is performed at intermediary decision node 804.Otherwise, it may be concluded in result node 810 that the incomingimage does not depict a live person, but is part of a presentationattack.

If it was determined that the incoming image is an image of a liveperson, then, in intermediary decision node 804, one or more imagerecognition modules are invoked to perform an iris recognition on theincoming image. A pupil localization result, derived as described inFIG. 6 and FIG. 7, may be provided to intermediate decision node 804along with additional input images acquired along with the incomingimage. The provided result and the images may be used by an irisrecognition module to determine whether the images show any changes incharacteristics of the depicted pupil.

If it was determined that the provided information indicates somechanges in characteristics of the depicted pupil, then result node 806is reached to indicate that the incoming image depicts a live person.However, if it is determined that the provided information does notindicate any changes in characteristics of the depicted pupil, thenresult node 808 is reached to indicate a presentation attack.

In an embodiment, a decision process depicted in FIG. 8 provides aneffective approach for detecting presentation attacks. It combines theapproaches for determining whether incoming images depict a live iris,and the approaches for determining whether the incoming images depict alive pupil. The performance of the system implementing the decisionprocess depicted in FIG. 8 may be measured using the indicators such asACER, NPCER and APCER, described above. A comparison of the resultsobtained when both the iris and the pupil analysis was performed withthe results when only the iris analysis was performed indicates that theapproaches implementing both the iris and the pupil analysis are moreeffective.

Iris and Pupil Liveness Detection Approach

A decision process of FIG. 8 for detecting presentation attacks may alsobe represented using a flow diagram. FIG. 9 is a flow diagram of anexample process for detecting presentation attacks according to anexample embodiment. In step 902, an image stream of RGB and NIR imagepairs is acquired using a mobile device. In an embodiment, this stepcorresponds to step 204 in FIG. 2.

An image stream may include a plurality of image pairs, and each imagepair of the plurality of images may include an RGB image and NIR image,both acquired in a synchronized manner. The image pairs may be acquiredusing for example, an RGB/NIR hybrid sensor that synchronously capturesboth the RGB image and the NIR image.

In an embodiment, an acquired stream of images may be processed toidentify at least one image pair that depicts an eye region in-focus.The identified image pairs may be further reviewed to determine oneimage pair that includes the images that provide the high qualitydepiction of the eye region.

In step 904, a hyperspectral image is generated from a selected RGB/NIRimage pair. This step corresponds to step 208 of FIG. 2. A hyperspectralimage is generated by fusing an RGB image with an NIR image of theRGB/NIR image pair using a fusing operator. A fusing operator may beexpressed using for example, expression (3).

In step 906, a feature vector for a hyperspectral image is generated.This step corresponds to step 214 of FIG. 2. A feature vector generatedfor an image represents one or more characteristics of an objectdepicted in the image. An example of characteristics may be a depictionof eyes in the image. In this example, a feature vector may be generatedfor an eye region detected in the image.

In step 908, one or more trained model feature vectors are retrievedfrom a storage unit. This step corresponds to step 216 of FIG. 2.Trained model feature vectors are vectors that were generated based onactual and reliable images of a live user of a mobile device. Thetrained model feature vectors are used as references in determiningwhether a feature vector generated from a hyperspectral image in step906 matches the trained model feature vectors within some threshold.

Once one or more trained model feature vectors are retrieved, a firstclassifier 910 is applied to the trained model feature vectors and afeature vector generated for a hyperspectral image. Applying firstclassifier 910 may include steps 912, 914 and 916.

A classifier is a means or an approach for classifying an image based onvisual contents of the image. Applying a classifier to an image allowsanalyzing contents of the image and analyzing the numerical propertiesof the image. Image classification allows processing the image'scontents to determine one or more image features and represent the imagefeatures as numerical properties.

In step 912, a distance metric (DM) is determined based on a featurevector generated from a hyperspectral image, and one or more trainedmodel feature vectors retrieved from a storage unit. This stepcorresponds to step 218 in FIG. 2. The DM may be computed using forexample, a Bayesian approach. The approach may utilize for example,expressions (7)-(8).

In step 914, a test is performed to determine whether a DM exceeds apredefined threshold. A threshold may be a numeric value determinedempirically based on for example, some training or experience. If the DMexceeds the threshold, then step 916 is performed. Otherwise, step 922is performed.

In step 916, an indication is generated to specify that an acquiredstream of images does not depict a live person, and instead it is apresentation attack. The indication may include an error message, a textmessage, an email, an audio signal, or any other form of communications.This step is performed when it has been determined that a distancebetween a feature vector and one or more training model feature vectorsexceeds a threshold, and therefore, there is no sufficient similaritybetween the RGB/NIR image pair and the actual/reliable images of theuser of a mobile device. Because the RGB/NIR image pair is notsufficiently similar to the actual/reliable images of the user, it maybe concluded that the RGB/NIR images do not depict the user of themobile device, and instead they depict an imposter.

Steps 922, 924, 926 and 928 include an application of a secondclassifier 920 to NIR images of two or more RGB/NIR image pairs.Alternatively, this process may be performed on two or more image pairs.

In step 922, a pupil characteristics analysis and an iris recognitionare performed on NIR images of RGB/NIR image pairs. This may be includecropping each of the NIR images so they depicts only eye regions. Thismay also include smoothing the cropped images using for example, asmoothing functions described in expression (10). Furthermore, this mayinclude generating an intermediate edge gradient image from the smoothedimage described in expression (11). The intermediate edge gradient imagemay be further transformed using a transformation operator T, as inexpression (14). Once locations of a pupil in the images is determined,one or more characteristics of the pupil are determined.

In step 924, a test is performed based on the identified characteristicsto determine whether there are any changes in the characteristics of theidentified pupil from image-to-image. An analysis of characteristics ofthe identified pupil may include an analysis of a pixel intensity in thepupil region in two or more NIR images. For example, an analysis ofpupil's characteristics may include determining whether a size of thepupil area, depicted in the images, is changing from image-to-image, orwhether an eye-blinking is depicted in the images.

If such changes are detected in the images, then step 928 is performed,in which an indication is generated that the images depict a liveperson. However, if no change can be detected, then in step 926, anindication is generated that the images are most likely provided as apresentation attack. For example, the images may be images taken from amannequin whose eyes have no dynamic characteristics, such as aneye-blinking. The indication may include an error message, a textmessage, an email, an audio signal, or any other form of communications.

In an embodiment, an iris liveness detection technique is presented forin iris recognition applications implemented in mobile devices. Thetechnique employs the ability to acquire a plurality of RGB/NIR imagepair by a mobile device in a synchronized manner. The technique alsoemploys the ability to collect and process iris biometrics using themobile device. The approach allows detecting whether acquired RGB/NIRimage pairs depict a live person or whether the images are presented asa presentation attack. The approach may be utilized to authenticate auser to the mobile device by detecting whether the user is indeed anauthorized owner of the mobile device.

The approach may be implemented on any type of mobile device. It doesnot require implementing or integrating any additional hardware. It maybe implemented as an authentication mechanism to authenticate a user toa mobile device and to detect authentication spoofing attempts.

Extensions

The approach may be further developed to include the ability to utilizevarious types of iris biometrics information, not only biometrics of aniris or a pupil. For example, the approach may be extended to take intoconsideration biometrics of fingerprints, noses, eyebrows, and the like.

The approach may also be enhanced by developing and providing a databasecontaining various types of biometrics data, and a database containinginformation about different types of advanced presentation attacks.

The approach may be implemented using the latest visible spectrum/NIRCMOS image sensor technologies.

Example Implementation System

According to some embodiments, the techniques described herein areimplemented by one or more special-purpose computing devices. Thespecial-purpose computing devices may be hard-wired to perform thetechniques, or may include digital electronic devices such as one ormore application-specific integrated circuits (ASICs) or fieldprogrammable gate arrays (FPGAs) that are persistently programmed toperform the techniques, or may include one or more general purposehardware processors programmed to perform the techniques pursuant toprogram instructions in firmware, memory, other storage, or acombination. Such special-purpose computing devices may also combinecustom hard-wired logic, ASICs, or FPGAs with custom programming toaccomplish the techniques. The special-purpose computing devices may bedesktop computer systems, portable computer systems, handheld devices,networking devices or any other device that incorporates hard-wiredand/or program logic to implement the techniques.

For example, FIG. 10 is a block diagram that depicts a computer system1000 upon which an embodiment may be implemented. Computer system 1000includes a bus 1002 or other communication mechanism for communicatinginformation, and a hardware processor 1004 coupled with bus 1002 forprocessing information. Hardware processor 1004 may be, for example, ageneral purpose microprocessor.

Computer system 1000 also includes a main memory 1006, such as a randomaccess memory (RAM) or other dynamic storage device, coupled to bus 1002for storing information and instructions to be executed by processor1004. Main memory 1006 also may be used for storing temporary variablesor other intermediate information during execution of instructions to beexecuted by processor 1004. Such instructions, when stored innon-transitory storage media accessible to processor 1004, rendercomputer system 1000 into a special-purpose machine that is customizedto perform the operations specified in the instructions.

Computer system 1000 further includes a read only memory (ROM) 1008 orother static storage device coupled to bus 1002 for storing staticinformation and instructions for processor 1004. A storage device 1010,such as a magnetic disk, optical disk, or solid-state drive is providedand coupled to bus 1002 for storing information and instructions.

Computer system 1000 may be coupled via bus 1002 to a display 1012, suchas a plasma display and the like, for displaying information to acomputer user. An input device 1014, including alphanumeric and otherkeys, is coupled to bus 1002 for communicating information and commandselections to processor 1004. Another type of user input device iscursor control 1016, such as a mouse, a trackball, or cursor directionkeys for communicating direction information and command selections toprocessor 1004 and for controlling cursor movement on display 1012. Thisinput device typically has two degrees of freedom in two axes, a firstaxis (e.g., x) and a second axis (e.g., y), that allows the device tospecify positions in a plane.

Computer system 1000 may implement the techniques described herein usingcustomized hard-wired logic, one or more ASICs or FPGAs, firmware and/orprogram logic which in combination with the computer system causes orprograms computer system 1000 to be a special-purpose machine. Accordingto one embodiment, the techniques herein are performed by computersystem 1000 in response to processor 1004 executing one or moresequences of one or more instructions contained in main memory 1006.Such instructions may be read into main memory 1006 from another storagemedium, such as storage device 1010. Execution of the sequences ofinstructions contained in main memory 1006 causes processor 1004 toperform the process steps described herein. In alternative embodiments,hard-wired circuitry may be used in place of or in combination withsoftware instructions.

The term “storage media” as used herein refers to any non-transitorymedia that store data and/or instructions that cause a machine tooperate in a specific fashion. Such storage media may comprisenon-volatile media and/or volatile media. Non-volatile media includes,for example, optical disks, magnetic disks, or solid-state drives, suchas storage device 1010. Volatile media includes dynamic memory, such asmain memory 1006. Common forms of storage media include, for example, afloppy disk, a flexible disk, hard disk, solid-state drive, magnetictape, or any other magnetic data storage medium, a CD-ROM, any otheroptical data storage medium, any physical medium with patterns of holes,a RAM, a PROM, and EPROM, a FLASH-EPROM, NVRAM, any other memory chip orcartridge.

Storage media is distinct from but may be used in conjunction withtransmission media. Transmission media participates in transferringinformation between storage media. For example, transmission mediaincludes coaxial cables, copper wire and fiber optics, including thewires that comprise bus 1002. Transmission media can also take the formof acoustic or light waves, such as those generated during radio-waveand infra-red data communications.

Various forms of media may be involved in carrying one or more sequencesof one or more instructions to processor 1004 for execution. Forexample, the instructions may initially be carried on a magnetic disk orsolid-state drive of a remote computer. The remote computer can load theinstructions into its dynamic memory and send the instructions over atelephone line using a modem. A modem local to computer system 1000 canreceive the data on the telephone line and use an infra-red transmitterto convert the data to an infra-red signal. An infra-red detector canreceive the data carried in the infra-red signal and appropriatecircuitry can place the data on bus 1002. Bus 1002 carries the data tomain memory 1006, from which processor 1004 retrieves and executes theinstructions. The instructions received by main memory 1006 mayoptionally be stored on storage device 1010 either before or afterexecution by processor 1004.

Computer system 1000 also includes a communication interface 1018coupled to bus 1002. Communication interface 1018 provides a two-waydata communication coupling to a network link 1020 that is connected toa local network 1022. For example, communication interface 1018 may bean integrated services digital network (ISDN) card, cable modem,satellite modem, or a modem to provide a data communication connectionto a corresponding type of telephone line. As another example,communication interface 1018 may be a local area network (LAN) card toprovide a data communication connection to a compatible LAN. Wirelesslinks may also be implemented. In any such implementation, communicationinterface 1018 sends and receives electrical, electromagnetic or opticalsignals that carry digital data streams representing various types ofinformation.

Network link 1020 typically provides data communication through one ormore networks to other data devices. For example, network link 1020 mayprovide a connection through local network 1022 to a host computer 1024or to data equipment operated by an Internet Service Provider (ISP)1026. ISP 1026 in turn provides data communication services through theworld wide packet data communication network now commonly referred to asthe “Internet” 1028. Local network 1022 and Internet 1028 both useelectrical, electromagnetic or optical signals that carry digital datastreams. The signals through the various networks and the signals onnetwork link 1020 and through communication interface 1018, which carrythe digital data to and from computer system 1000, are example forms oftransmission media.

Computer system 1000 can send messages and receive data, includingprogram code, through the network(s), network link 1020 andcommunication interface 1018. In the Internet example, a server 1030might transmit a requested code for an application program throughInternet 1028, ISP 1026, local network 1022 and communication interface1018.

The received code may be executed by processor 1004 as it is received,and/or stored in storage device 1010, or other non-volatile storage forlater execution.

In the foregoing specification, embodiments of the approach have beendescribed with reference to numerous specific details that may vary fromimplementation to implementation. The specification and drawings are,accordingly, to be regarded in an illustrative rather than a restrictivesense. The sole and exclusive indicator of the scope of the approach,and what is intended by the applicants to be the scope of the approach,is the literal and equivalent scope of the set of claims that issue fromthis application, in the specific form in which such claims issue,including any subsequent correction.

1-20. (canceled)
 21. An electronic device comprising: an image sensor;one or more processors; and one or more computer-readable media storinginstructions that, when executed by the one or more processors, causethe electronic device to perform operations comprising: generating, at afirst time and using the image sensor, first image data representing aneye, the first image data being associated with a first image type;determining, based at least in part on the first image data, a firstcharacteristic associated with the eye; generating, at a second time andusing the image sensor, second image data representing the eye, thesecond image data being associated with the first image type;determining, based at least in part on the second image data, a secondcharacteristic associated with the eye; determining that the eye isassociated with a user based at least in part on the firstcharacteristic and the second characteristic; and generating, using theimage sensor, third image data representing the eye, the third imagedata being associated with a second image type that is different thanthe first image type.
 22. The electronic device as recited in claim 21,the operations further comprising identifying the user based at least inpart on the third image data.
 23. The electronic device as recited inclaim 21, wherein: the first image data represents a first nearinfra-red image depicting the eye; the second image data represents asecond near infra-red image depicting the eye; and the third image datarepresents a red-green-blue image depicting the eye.
 24. The electronicdevice as recited in claim 21, wherein the image sensor comprises ared-green-blue/near infra-red hybrid sensor.
 25. The electronic deviceas recited in claim 21, the operations further comprising: determining achange between the first characteristic and the second characteristic,wherein determining that the eye is associated with the user is based atleast in part on the change.
 26. The electronic device as recited inclaim 21, the operations further comprising: determining a changebetween the first characteristic and the second characteristic; anddetermining that the change is equal to or greater than a thresholdchange, wherein determining that the eye is associated with the user isbased at least in part on the change being equal to or greater than thethreshold change.
 27. The electronic device as recited in claim 21, theoperations further comprising: determining, based at least in part onthe first image data, a third characteristic associated with the eye;and determining, based at least in part on the second image data, afourth characteristic associated with the eye, wherein determining thatthe eye is associated with the user is further based at least in part onthe third characteristic and the fourth characteristic.
 28. Theelectronic device as recited in claim 21, wherein: the firstcharacteristic includes a first size of a pupil area of the eye; and thesecond characteristic includes a second size of the pupil area of theeye.
 29. A method comprising: generating, at a first time and using animage sensor, first image data representing an eye, the first image databeing associated with a first image type; determining, based at least inpart on the first image data, a first characteristic associated with theeye; generating, at a second time and using the image sensor, secondimage data representing the eye, the second image data being associatedwith the first image type; determining, based at least in part on thesecond image data, a second characteristic associated with the eye;determining that the eye is associated with a user based at least inpart on the first characteristic and the second characteristic; andgenerating, using the image sensor, third image data representing theeye, the third image data being associated with a second image type thatis different than the first image type.
 30. The method as recited inclaim 29, further comprising identifying the user based at least in parton the third image data.
 31. The method as recited in claim 29, wherein:the first image data represents a first near infra-red image depictingthe eye; the second image data represents a second near infra-red imagedepicting the eye; and the third image data represents a red-green-blueimage depicting the eye.
 32. The method as recited in claim 29, whereinthe image sensor comprises a red-green-blue/near infra-red hybridsensor.
 33. The method as recited in claim 29, further comprising:determining a change between the first characteristic and the secondcharacteristic, wherein determining that the eye is associated with theuser is based at least in part on the change.
 34. An electronic devicecomprising: an image sensor; one or more processors; and one or morecomputer-readable media storing instructions that, when executed by theone or more processors, cause the electronic device to performoperations comprising: generating, at a first time and using the imagesensor, first image data representing an eye; determining, based atleast in part on the first image data, a first characteristic associatedwith the eye; generating, at a second time and using the image sensor,second image data representing the eye; determining, based at least inpart on the second image data, a second characteristic associated withthe eye; determining a change between the first characteristic and thesecond characteristic; and determining that the eye is associated with auser based at least in part on the change.
 35. The electronic device asrecited in claim 34, the operations further comprising: determining thatthe change is equal to or greater than a threshold change, whereindetermining that the eye is associated with the user is based at leastin part on the change being equal to or greater than the thresholdchange.
 36. The electronic device as recited in claim 34, wherein: thefirst characteristic includes a first size of a pupil area of the eye;and the second characteristic includes a second size of the pupil areaof the eye.
 37. The electronic device as recited in claim 34, wherein:the image sensor is a first type of image sensor; the electronic devicefurther comprises an additional image sensor, the additional imagesensor being a second type that is different than the first type; andthe operations further comprise generating third image data using theadditional image sensor.
 38. The electronic device as recited in claim34, wherein the image sensor is at least a near infra-red image sensor.39. The electronic device as recited in claim 34, the operations furthercomprising: determining, based at least in part on the first image data,a third characteristic associated with the eye; and determining, basedat least in part on the second image data, a fourth characteristicassociated with the eye, wherein determining that the eye is associatedwith the user is further based at least in part on the thirdcharacteristic and the fourth characteristic.
 40. The electronic deviceas recited in claim 34, the operations further comprising: generating,at a third time and using the image sensor, third image datarepresenting an additional eye; determining, based at least in part onthe third image data, a third characteristic associated with theadditional eye; generating, at a fourth time and using the image sensor,fourth image data representing the additional eye; determining, based atleast in part on the fourth image data, a fourth characteristicassociated with the additional eye; determining that the thirdcharacteristic is similar to the fourth characteristic; and identifyinga spoofing attack based at least in part on the third characteristicbeing similar to the fourth characteristic.